Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code.
Either an employee has access to these credentials or not. Each employee has access to these credentials, can hijack the domain, i.e. transfer it to a different registrar.
How to secure domains from malicious domain admin employees?
Is there something like "multisig" (a term from the crypto currency world) where two of three people or 3 of 5 etc. (depending on company size) need to authorize domain related changes?